I just realized I never reported back on the solution for this. It is
best described by this portion of the thread:
<Peter Dow>
I think the problem is that it doesn't know what the authority of the
trigger program is because it doesn't have authority to the library the
trigger program is in. Something like having lots of money but you can't
spend it because it's locked up and you don't have the key.
</Peter Dow>
<Roger Mackie>
Right on the point! My stored procedure went to the vault with a
borrowed key. The DBMS recognized the key as borrowed and would not
honor it. My solution is to have the stored procedure request a teller
(batch job with *ALL authority to the file) that does own a valid key to
access the vault, put in the data in the vault and give the stored
procedure a receipt.
</Roger Mackie
Having the stored procedure use a data queue to pass the insert/update
request (including job ID) to another job running with the necessary
authority and sending the results of the request through another data
queue (keyed by job) does work.
HTH someone,
Roger Mackie
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[
mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Mackie, Roger L.
(Precision Press)
Sent: Wednesday, April 04, 2007 9:46 AM
To: Midrange Systems Technical Discussion
Subject: RE: Adopted authority and triggers
Thank you for sharing your information center search expertise! I read
the link you suggested. It says "Circumvention None". Nevertheless, I
tried the recommendation for trigger creation that you found on the
information center. I still get the CPF4236. So I guess this isn't a
circumvention recommendation, but good design practice that we should
probably adopt even though it does not fix the immediate problem.
Thank you once again for taking the time to help me understand the
issue.
Roger Mackie
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[
mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Ed Fishel
Sent: Wednesday, April 04, 2007 9:02 AM
To: Midrange Systems Technical Discussion
Subject: RE: Adopted authority and triggers
<snip>
Create the program with USRPRF(*OWNER) and *EXCLUDE public authority,
and do not grant authorities to the trigger program to USER(*PUBLIC).
Avoid having the trigger program altered or replaced by other users.
The database calls the trigger program even if the user causing the
trigger program to run has authority to the trigger program.
Create the program in the physical file's library.
After reading this recommendation I did not understand why the public
authority of the trigger program should be *EXCLUDE but the public
authority of its library would cause it to not be called. I talked to
some people and they led me to this:
http://www-1.ibm.com/support/docview.wss?rs=0&q1=SYSTEM+I&q2=SE24253&uid
=nas2f38beb54b4aebe1f8625710a0072e90b&loc=en_US&cs=utf-8&cc=us&lang=en
(I found the page by going to
http://www.ibm.com/support/us/ and typing
"System i" in the Search Technical support search field and pressing
Enter.
I then typed "SE24253" in the Additional Search terms field and pressed
Enter again.) The bottom line is that this is a known problem and it
will be fixed.
Ed Fishel,
edfishel@xxxxxxxxxx
midrange.com
